AI governance sized to how your company actually uses AI.
We find every AI use case, from ChatGPT and Copilot to your own agents and models, set its risk level and your role under the EU AI Act, and pick only the controls it needs. Every decision is written down with its reason, so you can still explain it to an auditor a year later.
- Standards
- EU AI Act · ISO/IEC 42001 · NIST AI RMF
- Sector overlays
- NIS2 · DORA · GDPR · CRA
- Price
- Fixed, set from 16 scoping questions
AI arrives faster than the rules for it
Staff use public AI services. Software you already bought switches on AI features in an update. Teams build chatbots and agents on internal documents. Meanwhile EU AI Act obligations start to apply in stages, and customers and auditors ask whether you follow ISO/IEC 42001.
The usual answers miss in both directions. A one-page AI policy does not tell anyone what to do with a customer-facing agent. A full document pack written for model developers buries a company that only uses Copilot. We set the amount of governance by your actual AI profile and record why each control is in or out.
What already applies and what comes next
- 2 Feb 2025AppliesProhibited practicesBanned AI uses apply. Providers and deployers must take measures to support AI literacy of their staff.
- 2 Aug 2025AppliesGeneral-purpose AI modelsObligations for providers of general-purpose AI (GPAI) models apply.
- 2 Aug 2026AppliesTransparencyPeople must be told when they talk to an AI system or see AI-generated content (Article 50).
- 2 Dec 2026UpcomingNew prohibitions, watermarkingAdded bans on AI that generates non-consensual intimate content. End of the grace period for marking synthetic content from systems already on the market.
- 2 Dec 2027UpcomingHigh-risk systems (Annex III)Requirements for stand-alone high-risk systems, such as credit scoring and recruitment, apply to providers and deployers.
- 2 Aug 2028UpcomingHigh-risk in regulated products (Annex I)AI that is part of products such as medical devices or machinery.
Dates as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744. We recheck them at the start of every project.
Three questions set the level of control
Each AI use case is rated on three axes. Together with an impact assessment, the ratings place it on one of four tiers, and each tier adds controls to the one below.
How much of the system is yours?
- External service
- AI feature in bought software
- Your own build on a model
- Your own model
Whose work or life does the output touch?
- Employees
- Customers
- The market
What does the system do without a person?
- Suggests
- Drafts for approval
- Acts on its own
Public AI services, Microsoft 365 Copilot on internal data
Baseline controls and an entry in the AI register
Your own chatbot over company documents
Architecture review and a test plan
An agent that takes actions with a financial or customer effect
Human oversight, limits on autonomy, a fallback scenario
A possible high-risk system under the EU AI Act
Mapping to the conformity requirements for a provider or a deployer
- AI features in bought software
- Agentic AI
- Lifecycle of your own models
- AI products for external users, including the CRA
- General-purpose AI models (GPAI)
- AI services for clients
One control, one piece of evidence, several standards
The EU AI Act, ISO/IEC 42001, NIST AI RMF and the sector rules share one catalogue of controls. A few examples of how one control counts several times:
| Control | EU AI Act | ISO/IEC 42001 | NIST AI RMF | NIS2 | DORA | GDPR |
|---|---|---|---|---|---|---|
| AI system register | not covered | |||||
| Risk and impact assessment | ||||||
| Human oversight | not covered | not covered | not covered | |||
| Supplier and third-party management | not covered | not covered | ||||
| Incident handling and reporting | ||||||
| Transparency to people | not covered | not covered |
Obligations for providers, deployers, importers and distributors, with the Digital Omnibus changes.
Clauses 4–10 and every Annex A control, with a Statement of Applicability.
Mapped to the target profile you choose.
NIS2, DORA including the register of ICT third-party providers, GDPR, and the CRA for AI products.
Six rules behind every project
A company that only uses Copilot does not get the document pack of a model developer.
One control and one piece of evidence count toward the EU AI Act, ISO/IEC 42001, NIS2 and DORA at once.
Limit the project to the EU AI Act alone, or to ISO/IEC 42001 readiness. Adding a standard later reuses the work already done.
If you choose ISO/IEC 42001 only but have EU AI Act obligations, we record them as out of scope and you confirm that in writing.
Each included or excluded control carries the rule, the input data, the source and the reason. Six months later anyone can see why.
A new AI system or a change in the rules reopens only the affected part. The rest is reused.
From 16 questions to a handed-over project folder
The project follows CORE, the delivery framework we use for every engagement. How CORE works →
- ScopingTogether we fill in a 16-question questionnaire: which AI services and systems you use, on what data, what decisions they make, which standards you need and by when. The answers set the effort and the fixed price.
- Kickoff and company profileYour participants and the processes you already run: ISMS, risk management, existing certifications.
- Inventory and classificationEach AI use case is described, rated on the three axes and given a tier from T1 to T4 and its set of modules.
- EU AI Act classificationYour role (provider, deployer, importer or distributor), a check against prohibited practices, the risk class, transparency duties and the dates that apply.
- Control selectionRules decide whether each control applies and a consultant confirms it. For ISO/IEC 42001 we prepare the Statement of Applicability with the reasons for every exclusion.
- DocumentsPolicies, procedures, registers and reports for your profile, each linked to the requirements it covers.
- Optional add-onsThreat models and a security test plan for your own AI systems. Preparation for the ISO/IEC 42001 certification audit.
- HandoverFinal presentation, implementation plan and the full project folder with data, decisions and evidence.
- Re-assessmentIn 6–12 months or when a new system appears, a separate, smaller project updates only what changed.
Eight deliverables, each with a job
The full picture of AI in the company, with risk tier and owner.
Role and risk class under the EU AI Act, the obligations and dates that apply.
What to implement and why, and what was excluded and on what grounds.
The basis for ISO/IEC 42001 certification readiness.
Each obligation marked done, in progress, gap, out of scope or not applicable.
Shows what adding another standard would take.
AI use, AI risk management, suppliers, incidents, human oversight and others your profile needs.
The audit trail and the starting point for the next re-assessment.
Threat models and the security test plan for your own AI systems (optional add-on).
A fixed price before the project starts
The effort comes from the scoping questionnaire: your existing certifications, the number and tier of AI systems, the modules and the sector overlays. Certifications you already hold, such as ISO/IEC 27001, cut the effort in proportion. A re-assessment after 6–12 months is a separate project and costs noticeably less than the first one, because it reuses the data and decisions.
- Existing certifications
- Number of AI systems
- Tier of each system
- Modules
- Sector overlays
What the project does not include
- Collecting the evidence pack for a certification audit.
- Implementing technical controls.
- Hands-on vulnerability testing of AI systems.
We can take the technical controls and the testing on as separate projects.
Start with the 16 questions
About five minutes, multiple choice. We go through your answers with you on a call, and then you get the scope and a fixed price.
- Your company
- AI you use
- Data and decisions
- Goals
- Contact
Step 1 of 5 · 0 of 16 answered
Your company
Size, sector and what you already have in place.
Frequently asked questions
Prefer to talk first?
On a short call we look at the AI you run and the rules you are worried about, and go through the questionnaire together.